The UMTS R9 (Universal Mobile Telecommunications System) standard defines the handover scheme between a macro cell and a HNB (Home NodeB), and the handover scheme between HNBs. In R9, the handover between macro cell and HNB and the handover between HNBs can employ a common hard handover procedure, and the SGSN (Serving GPRS Support Node) of the Core Network (CN) can participate in the whole handover procedure.
Since HNB covers a relatively smaller range (usually covers the range of several tens of meters), several HNB may be deployed in the same application scenario, and handover between HNB cells may occur due to the movement of the mobile user. When such handover frequently occurs, it brings corresponding burden to the network side. In order to reduce the impact to CN (Core Network), to HNBs under the same HNB Gateway (GW), there may be a handover optimizing scheme that the handover signaling between HNBs is terminated at the HNB GW in case that no Iur interface exists between HNBs, as illustrated in FIG. 1A; there may be another handover optimizing scheme that the handover signaling between HNBs is forwarded via the HNB GW and terminated at the HNB GW in case that Iur interface exists between HNBs, as illustrated in FIG. 1C; or there may be still another handover optimizing scheme that the handover signaling between the HNBs is directly transferred via the Iur interface in case that Iur interface exists between HNBs, as illustrated in FIG. 1B.
Nowadays, in UMTS system, during the hard handover procedure where the handover signaling is terminated at the SGSN, if the source node is HNB, CK (Ciphering Key) and IK (Integrity Key) will not change after the UE is handed over from the source HNB to the target node (including RNC or HNB), i.e., the source HNB knows the key used by the target node; due to the vulnerability of HNB's location (unlike the RNC that is located in the operator's computer room), an attacker will acquire the key of the target node if it acquires the key of the source HNB. Similarly, with respect to the handover between HNBs under the same HNB GW in UMTS system, in the case that an Iur interface exists between HNBs, the security problem of key separation will also occur after the UE is handed over from the source HNB to the target HNB. Further, in UMTS system, similarly to the above handover scenario, the security problem of key separation will also occur when UE moves from an HNB to the RNC or another HNB in idle mode.